Process Harmonization to address High Cost of Compliance : Insights from Implementation. Keerthana Mainkar & Jude Fernadez

Transcription

1 Process Harmonization to address High Cost of Compliance : Insights from Implementation Keerthana Mainkar & Jude Fernadez 16 th September 2010

2 Topics to be covered Introduction Compliance as a driver Process Harmonization Case Studies Scenario and challenges Methods used Case Analysis Conclusions 2

3 The Compliance Imperative Failing organizations Increased corporate fraud Multiple regulatory requirements Regulatory compliance no option but to comply Multinational organizations with different processes and industries spending upwards of 100 MUSD per year on compliance Regulatory Compliance market size estimated at 33 BUSD per year (cost to include HW, SW, Internal head count and consulting expenses) 3

4 Compliance Challenges Compliance is not a one time activity - clean up and stay clean Multiple regulations and multiple overlapping compliance initiatives Different processes, dissimilar systems, disparate controls, redundant controls and more number of manual controls Not enough importance given to process efficiency as against Effectiveness Regulatory compliance is there because there is a business process and not vice a versa Inadequate adoption of IT to enable compliance and over reliance on manual assessment for controls monitoring 4

5 Cost Compliance cost Indicators MNC with operations in 10 countries Approximately 200 controls per country with 20:80 break up of automated and manual controls High Total controls is 2000 Controls split is 400:1600 Total time taken to test controls is hours (8 hours per manual control and 3 hours for automated control) Average cost of compliance per hour 100 USD Cost of control testing per quarter is 1.4MUSD Medium Low Period Cost of Manual control Cost of Automated control If thru process / controls harmonization, optimization and automation, total number of controls can be reduced to 400 with a split of 60:40 (automated: manual), cost of ongoing compliance testing will come down to as low as 195k ** per quarter ** The above mentioned cost is indicative as there will be one time automation cost. 5

6 Efficient Compliance Process harmonization to reduce cost of compliance Compliance Road Map Non Existent Initial Ad hoc Repeatable Defined and Managed Up to Onwards First Gen : Reactive Compliance Second Gen : Proactive Compliance Efficient Compliance Optimized Standard Framework Standardized processes Optimization of controls Automization of Controls The compliance space has matured over a period of time and is aiming for achieving efficiency along with effectiveness. Efficiency leads to cost reduction but efficiency cannot be achieved unless the compliance initiative is automated and controls are optimized. Controls cannot be optimized unless the controls are standardized. No amount of effort for standardization of controls will yield results unless business processes are standardized. Remote monitoring of controls Reduced Compliance Cost Efficient compliance means following a consistent framework approach to achieve efficiency in reporting, consolidation and evaluation of controls. It is strategic, proactive and a long term compliance perspective. 6

7 Efficient Compliance Can we harmonize controls without harmonizing the underlying processes??? NO 7

8 The Drivers Process Harmonization.Lit Survey Defined...process of designing and implementing business process standardization across different regions / units.so as to facilitate achievement of the targeted business benefits arising out of standardization.whilst ensuring a harmonious acceptance of the new processes by the different stakeholders. Cost as a driver!! Process proliferation as a cause of high cost of compliance Process operational costs including IT hardware and software, personnel costs Ensuring standard and uniform customer experience (internal & external) Reduce complexity of managing a global organization Including efficient integration with customers, partners, suppliers etc Better control and visibility to senior management Enabling business process outsourcing in a more effective manner New Additional Driver: Cost of compliance Control design / implementation, auditing, consultant fees etc Challenges Faced Balancing needs of stakeholders and Change management Cost & Complexity of the Harmonization Initiative Large initiative risks Regional Constraints Bhat & Fernadez Decision Making on Re-use of Existing Processes & IT Infrastructure and assets People redeployment??? 8

9 Process Harmonization: Methods Used (Lit Survey) As-Is Discovery Process Analysis Elaborate and Finalize To-Be Rollout and Implement Define process scope of program Gather data on each variant Identify representative regions Decision on which regions to be mapped Map regional processes; Gather issues, process differentiators, specific organizational and customer needs Analyze mapped variants Decide on the # of standard processes required Develop the base To- Be process Develop Tailoring Guidelines (Governance Mechanism) Reviews by all key stakeholders Finalize process and ensure buy-in Choice of sequence of locations for the rollout Defining local variants as per Tailoring Guidelines Finalize Regional processes Bhat. J. and Fernandez, J. Addressing the Complexities of Global Process Harmonization, Handbook of Research on Complex Dynamic Process Management: Techniques for Adaptability in Turbulent Environments Team staffing: Right representation from all stakeholders, right competencies and time Early employee involvement: To pre-empt change management issues; Sr Exec leadership support; Best practices (internal & external)( Process ownership roles: to own and manage the new process & ensure their buy-in Define the standard process based on the above before deciding on the IT systems Muenstermann, B., Moederer. P. and Weitzel, T. Setting up and Managing Business Process Standardization: Insights from a case study with a multinational e-commerce firm 9

10 Case Study 1: Auto Company Company Background One of the largest auto and truck manufacturers in the world with manufacturing plants spread out across the world. Operating more than 60 countries Process Harmonization Scenario Sponsored by the IT group Cost was the primary driver with targeted savings of 40% in the TCO Each country had its own process variants with unique process controls; with different flavors of legacy applications Objective: To bring in a single SAP platform with a single IT team Covered the Wholesale business: including Sales & Dist, Order to Cash, factory ordering (excluding manufacturing) Challenges Program initiated by the IT group Huge pushback from the business side initially As-Is Capture Methodology followed Company had good SMEs in each process area; they took the responsibility for mapping the As-Is processes. These were captured in Visio & Word Design of To-Be Initial pilot template created in one region which was later enhanced with SAP best practices, regional best practices and presented during Business Blueprinting Workshops. Regional SMEs debated and finalized it. Template was progressively developed across regions Implementation Asia was taken as the pilot and a template created. Subsequently, this template was taken to Europe which was then customized for that region s characteristics (began with 2 countries and then taken one by one for customization & rollout) Initial regions chosen based on multiple factors (size, representative, volunteers, change management effort etc) Governance Program sponsored and driven by the IT group Clear mandate given to them. Business SMEs represented each region to sign off on the new processes. Good Business-IT collaboration Compliance Controls Compliance team used the output of the workshops to ensure that the right controls are put in place more passive 10

11 Case Study 2: Electronic Components Company Company Background Fortune 200 company in the area of electronic components and computer products specializing in distribution and value-added services. Having operations out of 51 countries in 300 plus locations. Process Harmonization Scenario Company seeking to move from functional-based to process based organization; $400m program 50 countries covered, grouped into 3 large chunks Challenges High resistance to change from the regional groups who were politically strong As-Is Capture Methodology followed Captured over a 3 month period by the Program team (joint team) using a proprietary Process Modeling based Requirements Analysis tool. Along with this they also worked on identifying the best practices Design of To-Be Straw man of the To-Be created combining best practices from the ERP best practices, domain knowledge and the As-Is process Workshop organized for each process with participation from each region Global To-Be process created after detailed discussions, verification and validation and finally prioritization Continuous Process Improvement teams (already existing in the company) analysed and classified each process requirement as non-value adding, customer value adding and business value adding. Implementation Rollout being carried out currently in 2 waves covering the different regions over a period of months. For each region, the local requirements were captured and tailored into the Global template. Currently, ANZ, N Europe & S Asia covered; others are in progress Governance Global Process Owner (VP level), fully dedicated to the initiative. There were also process owners at each regional level as well Each Process change had 3 levels of approval including the Global Process Owner Compliance Controls Compliance team used the output of the workshops to ensure that the right controls are put in place more passive 11

12 Case Study 3: Power Company Company Background One of the leading players in the automation and power and technologies space. One of the largest engg companies and conglomerates, the company has over 100,00 employees with customers spread out in around 100 countries. Process Harmonization Scenario Sponsored by the Global CFO Primary driver to bring in standardization of processes, ERP instances and especially, Reporting & Compliance Multiple SAP instances across the world, e.g., one country had 13 divisions with 8/9 ERP instances Manufacturing & Sales Planning, Finance? Shared services center for Fin and HR already in place Challenges Huge resistance to change from regional business units Time overrun: planned for 13 months; extended by 6 months As-Is Capture Methodology followed As-Is process captured in Excel sheets in the Business Blue-printing Workshops which had reps from all regions. Higher level mapping was done earlier Design of To-Be Collective agreement to use SAP best practices as the main driver for the To-Be. Initial template prepared combining this along with As- Is best practices Consolidation involved handling the different versions of SAP as well as the multiple divisions Designing access to SAP in accordance with To Be process Implementation Involved considerable selling & trainings on the new process to the business units. Due to high resistance to change, the scope of the initiative was narrowed down to 3 business divisions and the others put on hold for the future Governance Program owned by the IT organization with a Regional CIO as the Program in charge Compliance Controls Active participation of compliance team in To Be process definition with focus on standardization, optimization and automation of controls. 12

13 Case Analysis: Similarities Large, multinational corporations spread out across the world In all cases the to-be IT landscape was already decided to be ERPbased Hence, To-Be creation largely influenced by the pre-decided target ERP package Core program team formed combining both the company and external consultants and business & IT Identification of best practices from As-Is was done in all cases As-Is analysis and To-Be creation largely manual efforts; and consultant / expert dependant Little leverage of tools, for e.g., for As-Is analysis, comparison of different To-Be models amongst others need for more research Resistance to change was a dominant common feature as the global To-Be template was being rolled out across different regions At least in one of the cases the resistance was such that the initiative scope had to be rolled back significantly with some business units being put on hold 13

14 Differences Governance Ownership: IT (2 of 3 cases) and by business groups in the other. Program ownership was different in each case: IT, business and Finance Strong mandate from the leadership levels was instrumental in ensuring buy-in in the face of huge resistance to change Process Ownership / Process SMEs BPM infrastructure in place (2 of 3 cases): Process owners (global /regional / local), and / or process SMEs who could provide inputs on As-Is documentation, review, validate and sign-off on the To-Be templates for their regions Emphasis on designing the ERP access in accordance with the To Be design In one of the cases (namely Auto company), huge emphasis was laid on designing the access to the system in accordance with the To Be design. This was done to avoid any process change from creeping in to the system at a later point of time in ERP environment. Drivers and motivations Cost, reporting standardization, process excellence main objectives of the program in most of the cases Compliance as an additional driver was seen in one of the cases (Power company) Compliance Controls In 2 of the 3 cases, compliance was a passive motivation alone. The group addressing compliance played a passive role Review of the To-Be and propose changes if required in the controls designed In the other case, controls optimization was one of the main objectives and the approach included evaluating and optimizing of the controls 14

15 Common Challenges faced in the cases Pre-decided IT landscape constraints To-Be design However, quality of the To-Be is limited by the process on the pre-decided system, for e.g., the package chosen As-Is process documentation involved effort and time of stakeholders (workshops or face to face meetings, travel costs) Cost and time taken for the As-Is phase vs value was a question Need to capture regional specific requirements (market/ customer /regulatory), competitive differentiators, best practices Design of To-Be Takes too long, and is complex Currently it is dependent on expert guidance (esp, if target process is not identified) To-Be: Resistance to the new process Politics and power equations; for eg, power of the local regional CEOs Resistance to reduction in number of controls 15

16 Effect of process harmonization on controls Let us analyze the impact this process harmonization had on controls in case study 3 16

17 Approach for controls standardization & optimization Documents Review Understand Business Processes Review process documents Process Standardization Identify by similar process Come up with standard processes Validation by all stake holders Control Optimization Classify Key and Non-Key controls Identify additional controls to bridge gaps (if any) Identify compensating controls for non key controls Finalize optimum controls to be implemented Control Automation Identify controls to be automated to ensure process efficiency Identify configurable controls for quick wins Perform Cost benefit analysis for Controls and discuss with Process owners Implement pilot Rollout automated controls across business units Remote Monitoring of controls KT to KS Consultants Periodical monitoring of controls Assessment and gap report preparation Gap Remediation Future compliance 17

18 Case Analysis: Controls Optimizations Controls optimization was done along with process harmonization. Three phased integrated approach followed to ensure right number and mix of controls at the design stage it self Proactive participation and push from the top for controls rationalization Outcome: Number of controls for country A: 3050 Number of controls post process harmonization: 980 Number of controls post controls optimization: 360 Number and Nature of harmonized and optimized controls: Automated 160 and Manual

19 Learnings & Research Directions How much to standardize? Lots of debate on this country level / region level or global standard? How to decide on how much standardization is best for a process for the company? What factors are to be analyzed for this? for example change mgmt efforts vs the expected benefits of a global template Practitioners will benefit with an approach to analyze pros and cons of different options to select the most suitable one Optimizing on As-Is process capture Methods to decide how much As-Is to capture All variants to be captured or capture some variants and build on top of these Process capture tools: Scope for bringing in more sophisticated methods and tools to save time, effort, complexity Note: Process harmonization here seen in the context of global organizations attempting standardization as part of a single large initiative Bottom-up process best practices roll-up (on a continuous basis) as in companies such as Toyota are worth analyzing for adoption in these contexts Handling of resistance to change Business Process Standardization, Tregear R, Handbook on Business Process Management Since these initiatives are large and high-risk, it might be worthwhile to explore bringing in structured change management techniques at appropriate stages in the initiative Handling people management to reduce resistance to change 19

20 Learnings & Research Directions Analysis of As-Is and Developing the To-Be Deciding upon the standard base process Decision on the target To-Be process: in case the end IT package has been chosen (how to bring in company best practices)? In other cases, how to create the To-Be in the shortest time and with minimum effort Opportunity to bring in suitable tools, for e.g., simulation to try out different process options to estimate impact on process performance Process excellence techniques can be adopted Process goals: cost, quality, time and other specific ones Use of value analysis to validate each process step Modeling of compliance controls and process modeling Today these are distinct and not amenable for integrated analysis Scope exists to develop integrated modeling approaches to streamline controls optimization in line with process standardization Governance Some governance structures have been proposed; these can be added to the practitioner toolkit with suggestions on appropriateness for different scenarios 20

21 Thank You For further information please contact authors & The contents of this document are proprietary and confidential to Infosys Technologies Ltd. and may not be disclosed in whole or in part at any time, to any third party without the prior written consent of Infosys Technologies Ltd Infosys Technologies Ltd. All rights reserved. Copyright in the whole and any part of this document belongs to Infosys Technologies Ltd. This work may not be used, sold, transferred, adapted, abridged, copied or reproduced in whole or in part, in any manner or form, or in any media, without the prior written consent of Infosys Technologies Ltd.